Lucene search

[email protected]NVD:CVE-2020-29653

HistoryApr 13, 2022 - 1:15 p.m.

CVE-2020-29653

2022-04-1313:15:07

CWE-79

[email protected]

web.nvd.nist.gov

froxlor 0.10.22

input validation

html injection

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

32.6%

JSON

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags.

Affected configurations

Nvd

Node

froxlorfroxlorRange≤0.10.22

VendorProductVersionCPE
froxlorfroxlor*cpe:2.3:a:froxlor:froxlor:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
froxlor	froxlor	*	cpe:2.3:a:froxlor:froxlor::::::::

References

github.com/Froxlor/Froxlor/commits/master

github.com/Froxlor/Froxlor/security/advisories

nozero.io/en/cve-2020-29653-froxlor-html-injection-dangling-markup/

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

32.6%

JSON

Related for NVD:CVE-2020-29653

osv2 veracode1 cvelist1 github1 cve1 prion1